Extracted

• • Target
    cead46e7a7c853c8b9ea0a8d43f8b5c64287af75fb64a64b2d3cf9f7cd64e59d
  • Size 45KB
  • SHA256 cead46e7a7c853c8b9ea0a8d43f8b5c64287af75fb64a64b2d3cf9f7cd64e59d
  • MD5 0865d3ed1e8416b0972af149eb532aa3
  • SHA1 1adb528a08863b81a8587b509bdf378d9c5dc806
  • SHA512 97d5b85fe273658b7d2a6dbd63181bc5f31e1776a0233dd8a3de0d23ea6a330e83816fa3b6a16de617587f35d0e0d2e65a08066668c0a86eb1deb0d8898b7cee
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6Ezjb/gX3ibTy4ABihp9/jBDZO:ku40ZTXEb2TeEoTNKA6E3bIXSb+XSll8
  • TLSH
    T110232A003BE8C12BF2BF5F7899F26145867AF2633603D54A1CC4519B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2